GitHub

When to use: A developer with just a browser should be able to get a key by signing in with GitHub. busbar hosts the sign-in and hands back the dev’s own budgeted key, ideal for Cursor / Claude Code / VSCode BYOK, where the tool just needs a static key and a base URL.

public_url: "https://busbar.example.com"   # busbar builds /auth/token itself
plugins:
  enabled: true
  fetch:
    - github: GetBusbar/[email protected]
identity-providers:
  github:
    module: github
    settings:
      client_id: "<github-oauth-client-id>"
    browser_login:                            # presence = "Continue with GitHub" button
      client_secret: { env: GITHUB_OAUTH_SECRET }
auth:
  signing_key: { file: /run/secrets/busbar-signing.key }
  chain: [keys]                               # the issued key authenticates here
  key_ttl: 90d                                # admin-set; default 90d, no dev choice
  role_bindings:
    github:
      "github:org/<org>": { group: engineering }

A dev opens GET /auth/token (busbar builds the URL from public_url), clicks Continue with GitHub, authorizes, and busbar returns their own static key: self-scoped github:<login>, budget auto-provisioned from the team’s child_default on first login, the secret shown then and re-shown on every later sign-in. The button label + GitHub icon are inferred; there’s nothing to name.

When to use: Access should follow GitHub org membership: everyone in your GitHub org gets the engineering team’s budget and pools, no per-dev setup.

public_url: "https://busbar.example.com"
plugins:
  enabled: true
  fetch:
    - github: GetBusbar/[email protected]
identity-providers:
  github:
    module: github
    settings:
      client_id: "<github-oauth-client-id>"
      scopes: [read:org, read:user]           # read:org is what powers the org hop
    browser_login:
      client_secret: { env: GITHUB_OAUTH_SECRET }
auth:
  signing_key: { file: /run/secrets/busbar-signing.key }
  chain: [keys]
  key_ttl: 90d
  role_bindings:
    github:
      "github:org/acme":     { group: engineering }
      "github:org/acme-ops": { group: platform }

After sign-in busbar reads GET /user/orgs and emits one github:org/<org> group per org the dev belongs to; role_bindings.github maps each to a busbar team. Note: the shipped plugin emits org groups only (github:org/<org>); it does not fetch or emit per-team (github:team/<org>/<team>) groups, so bind on orgs. Set fetch_orgs: false to skip this hop entirely (identity from /user alone, no groups).

When to use: Your developers live on a self-hosted GitHub Enterprise Server, not github.com. Point the three base URLs at your instance; the token-exchange + identity flow is otherwise unchanged.

public_url: "https://busbar.example.com"
plugins:
  enabled: true
  fetch:
    - github: GetBusbar/[email protected]
identity-providers:
  github:
    module: github
    settings:
      client_id: "<ghes-oauth-client-id>"
      api_base:       "https://ghe.corp.example/api/v3"   # REST API base (note /api/v3)
      authorize_base: "https://ghe.corp.example"          # /login/oauth/authorize
      token_base:     "https://ghe.corp.example"          # /login/oauth/access_token
      ca_cert_pem:    { file: /etc/busbar/ghes-ca.pem }   # if GHES is behind an internal CA
    browser_login:
      client_secret: { env: GITHUB_OAUTH_SECRET }
auth:
  signing_key: { file: /run/secrets/busbar-signing.key }
  chain: [keys]
  key_ttl: 90d
  role_bindings:
    github:
      "github:org/<org>": { group: engineering }

The three *_base overrides are the whole change: api_base gets GHES’s /api/v3 REST root, authorize_base/token_base get its web host. Note: ca_cert_pem is accepted for forward-compatibility but on the committed 1.5.2 ABI the core executes the hops and has no channel to receive it yet, so a GHES behind a private CA needs that CA trusted at the busbar host level for now.

When to use: You just want a GitHub sign-in to mint a key and don’t map org membership to teams, e.g. a small team, a personal instance, or where every dev should land on one default team. Skip the org hop entirely.

public_url: "https://busbar.example.com"
plugins:
  enabled: true
  fetch:
    - github: GetBusbar/[email protected]
identity-providers:
  github:
    module: github
    settings:
      client_id: "<github-oauth-client-id>"
      scopes: [read:user]                      # drop read:org, no org enumeration
      fetch_orgs: false                        # skip the /user/orgs hop; no groups emitted
    browser_login:
      client_secret: { env: GITHUB_OAUTH_SECRET }
auth:
  signing_key: { file: /run/secrets/busbar-signing.key }
  chain: [keys]
  key_ttl: 90d
  # no role_bindings.github needed: with no groups, every dev lands on the default team

fetch_orgs: false establishes identity from GET /user alone (one fewer hop) and emits no github:org/<org> groups, so there is nothing for role_bindings.github to match and every signed-in dev gets the default team’s budget. Dropping read:org from scopes narrows what busbar asks GitHub for, since the org read is no longer needed. Identity is still github:<login>.